Root causes of 2024/2025 open source supply chain compromises